THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-v3r7-h72x-cjcm (medium) — undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields

[GHSA] GHSA-v3r7-h72x-cjcm (medium) — undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields

medgithub_advisoriesPublished 2026-08-03

GHSA-v3r7-h72x-cjcm Severity: medium CVE: CVE-2026-16729

undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields

## Impact

The `setCookie` function has two attribute injection paths. `validateCookieDomain` does not reject semicolons (`validateCookiePath` already does at 0x3B), so a `domain` value like `example.com; SameSite=None` lands verbatim as `D

Indicators of compromise

CVE-2026-16729cve

Original source: https://github.com/advisories/GHSA-v3r7-h72x-cjcm